World map

 

BM

World A2: Keys & Guards

Least privilege

You will learn: to give only the keys a job needs, and how to shrink keys that are too big.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

The cleaner comes at night to tidy the storeroom. Which key do you give?

Watch

That idea is least privilege: Give only the keys a job needs: these actions, on these things. Nothing more.: these actions, on these things, nothing more. Fits the idea, or too much?

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

The menu robot may put files in kedai-menu only.

Try it

The menu robot must never delete. Its key allows every S3 action. Shrink the pink line so a delete gets Deny.

Change the pink line so AWS says Deny.

The request

Who
menu robot (IAM user)arn:aws:iam::111122223333:user/menu-robot
Wants to
s3:DeleteObject
On
arn:aws:s3:::kedai-menu/today.json
Identity policy (key ring) · menu-robot
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Resource": "arn:aws:s3:::kedai-menu/*"
}
]
}

Predict

AWS ships ready-made managed policies, like ReadOnlyAccess. Are they least privilege for your robot?

Check

Too-big keys shrink in steps. Put them in order.

First step at the top. Put these in order. Use the arrows, or drag.

  • Test it: read any AccessDenied error
  • Write down what the job really does
  • Check last accessed data for unused rights
  • Remove what is never used
  • Start with a small policy for that

You did it!

You can now shrink a policy to just what a job needs.

Go deeper (optional)

IAM Access Analyzer can read your activity log (CloudTrail). It drafts a policy from what was really used. Treat the draft as a start, then review it.

Real rep (free): in the IAM console, open your admin user’s “Last accessed” tab. Which services has it never touched?